2026-06-23 22:30:37
(1 day ago)
[redacted] 38.132.59.240 - - [24/Jun/2026:00:30:35 +0200] "POST /xmlrpc.php HTTP/1.1" 200 230 "-" "M ...
show more
[redacted] 38.132.59.240 - - [24/Jun/2026:00:30:35 +0200] "POST /xmlrpc.php HTTP/1.1" 200 230 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Firefox/78.0"
[redacted] 38.132.59.240 - - [24/Jun/2026:00:30:35 +0200] "POST /xmlrpc.php HTTP/1.1" 200 230 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:49.0) Gecko/20100101 Firefox/49.0"
[redacted] 38.132.59.240 - - [24/Jun/2026:00:30:36 +0200] "POST /xmlrpc.php HTTP/1.1" 200 230 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:96.0) Gecko/20100101 Firefox/96.0"
[redacted] 38.132.59.240 - - [24/Jun/2026:00:30:36 +0200] "POST /xmlrpc.php HTTP/1.1" 200 230 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0"
[redacted] 38.132.59.240 - - [24/Jun/2026:00:30:36 +0200] "POST /xmlrpc.php HTTP/1.1" 200 230 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:63.0) Gecko/20100101 Firefox/63.0"
[redacted] 38.132.59.240 - - [24/Jun/2026:00:30:36 +0200] "POST /xmlrpc.php HTTP/1.1" 200 230
...
show less
Hacking
Web App Attack
2026-06-23 15:14:37
(2 days ago)
[redacted] 38.132.59.240 - - [23/Jun/2026:17:14:36 +0200] "POST /xmlrpc.php HTTP/1.1" 200 230 "-" "M ...
show more
[redacted] 38.132.59.240 - - [23/Jun/2026:17:14:36 +0200] "POST /xmlrpc.php HTTP/1.1" 200 230 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0"
[redacted] 38.132.59.240 - - [23/Jun/2026:17:14:36 +0200] "POST /xmlrpc.php HTTP/1.1" 200 230 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0"
[redacted] 38.132.59.240 - - [23/Jun/2026:17:14:36 +0200] "POST /xmlrpc.php HTTP/1.1" 200 230 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0"
[redacted] 38.132.59.240 - - [23/Jun/2026:17:14:36 +0200] "POST /xmlrpc.php HTTP/1.1" 200 230 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:54.0) Gecko/20100101 Firefox/54.0"
[redacted] 38.132.59.240 - - [23/Jun/2026:17:14:36 +0200] "POST /xmlrpc.php HTTP/1.1" 200 230 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0"
[redacted] 38.132.59.240 - - [23/Jun/2026:17:14:36 +0200] "POST /xmlrpc.php HTTP/1.1" 200 230
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-23 14:46:15
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 38.132.59.240 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 38.132.59.240 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 10:46:10.981855 2026] [security2:error] [pid 15915:tid 15915] [client 38.132.59.240:44372] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.fundaciondamashcc.org.ec|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.fundaciondamashcc.org.ec"] [uri "/wp-json/wp/v2/users"] [unique_id "ajqcMqy9qVlN6DVwc6OVhQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-23 05:40:26
(2 days ago)
[server.tmg.gr] httpd-suspicious-path: sites=aidshep2017.gr; logs=/var/log/httpd/domains/aidshep2017 ...
show more
[server.tmg.gr] httpd-suspicious-path: sites=aidshep2017.gr; logs=/var/log/httpd/domains/aidshep2017.gr.log; samples=/wp-json/wp/v2/users | /?author=1 | /?author=2
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-22 16:39:54
(3 days ago)
(mod_security) mod_security (id:225170) triggered by 38.132.59.240 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 38.132.59.240 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 12:39:51.107521 2026] [security2:error] [pid 25105:tid 25105] [client 38.132.59.240:45256] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.hotpay.co|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.hotpay.co"] [uri "/wp-json/wp/v2/users"] [unique_id "ajllV9fBjvx5ReRHK1ARVQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-22 02:39:23
(3 days ago)
(mod_security) mod_security (id:225170) triggered by 38.132.59.240 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 38.132.59.240 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 22:39:18.037448 2026] [security2:error] [pid 9491:tid 9491] [client 38.132.59.240:39784] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.innolympics.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.innolympics.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajigVuiak7QQ9o2clHaOFAAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-21 12:01:47
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 38.132.59.240 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 38.132.59.240 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 08:01:43.145718 2026] [security2:error] [pid 15805:tid 15805] [client 38.132.59.240:48174] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||marinestorage.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "marinestorage.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajfSp-IVuT6LsOq8lyRc9wAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-20 19:31:46
(4 days ago)
(mod_security) mod_security (id:225170) triggered by 38.132.59.240 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 38.132.59.240 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 20 15:31:39.055446 2026] [security2:error] [pid 2307:tid 2307] [client 38.132.59.240:60062] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.graymatterofdc.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.graymatterofdc.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajbqm5utEfb31-_BtkXoOAAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-20 17:24:19
(5 days ago)
(mod_security) mod_security (id:225170) triggered by 38.132.59.240 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 38.132.59.240 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 20 13:24:12.294813 2026] [security2:error] [pid 25573:tid 25573] [client 38.132.59.240:35044] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.nypatriotcards.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.nypatriotcards.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajbMvEVaerN3393mSpZ7qAAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-20 00:12:47
(5 days ago)
(mod_security) mod_security (id:225170) triggered by 38.132.59.240 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 38.132.59.240 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 20:12:42.173299 2026] [security2:error] [pid 21822:tid 21822] [client 38.132.59.240:56194] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.bickleton.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.bickleton.org"] [uri "/wp-json/wp/v2/users"] [unique_id "ajXa-nwC7_yVziYP8vDTXwAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-18 09:25:20
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 38.132.59.240 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 38.132.59.240 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 18 05:25:13.849377 2026] [security2:error] [pid 8240:tid 8240] [client 38.132.59.240:47718] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||learnserve.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "learnserve.net"] [uri "/wp-json/wp/v2/users"] [unique_id "ajO5ef9jXO7US9zp24ecZgAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Dolphi
2026-06-18 09:20:03
(1 week ago)
Excessive POST /wp-login.php requests
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-18 08:04:03
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 38.132.59.240 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 38.132.59.240 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 18 04:03:56.566701 2026] [security2:error] [pid 26353:tid 26353] [client 38.132.59.240:53230] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.boaredraven.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.boaredraven.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajOmbHEZbB2zOHxy76kzQAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-17 22:40:07
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 38.132.59.240 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 38.132.59.240 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 18:40:04.107993 2026] [security2:error] [pid 19935:tid 19935] [client 38.132.59.240:47220] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.dceabronwilliams.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.dceabronwilliams.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajMiRLnHtD_4a4z8ds8d2AAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-17 17:46:23
(1 week ago)
(mod_security) mod_security (id:225170) triggered by 38.132.59.240 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 38.132.59.240 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 13:46:18.155099 2026] [security2:error] [pid 2508:tid 2508] [client 38.132.59.240:43616] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.greensandbeans.us|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.greensandbeans.us"] [uri "/wp-json/wp/v2/users"] [unique_id "ajLdam2mgSAFckn7UuDauAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack